GeezerVison

Fixes #813.

A redirect for the code (or code id_token) response type that has no code parameter and no error parameter is currently delivered as a successful OIDAuthorizationResponse with authorizationCode == nil. OIDAuthState's convenience flow then calls tokenExchangeRequest on it, which raises kTokenExchangeRequestException, so the app crashes instead of getting an error in the callback.

This adds a check in resumeExternalUserAgentFlowWithURL:error:, right after the state validation: if the request's response type includes code and the response has none, the flow fails with OIDOAuthAuthorizationErrorDomain / OIDErrorCodeOAuthAuthorizationClientError, the same error the state check uses, with a message that names the missing parameter (RFC 6749 section 4.1.2). Checking at the session level rather than only in OIDAuthState also covers apps that call OIDAuthorizationService directly and do the exchange themselves. The order of checks is unchanged: an OAuth error response is still reported as the server's error, and a state mismatch still wins.

Tests (in OIDAuthorizationServiceTests, driven through a small synchronous fake OIDExternalUserAgent):

• code flow without code returns the client error and no response
• code id_token without code returns the client error
• code flow with code still succeeds
• error=access_denied still maps to OIDErrorCodeOAuthAuthorizationAccessDenied
• state mismatch is still reported as a state mismatch when the code is also missing
• OIDAuthState convenience flow calls back with the error instead of raising (on current master this test fails with the kTokenExchangeRequestException from the issue)

Ran the AppAuth_macOS test bundle locally (Xcode 27.2, Apple Silicon): 180 tests, 0 failures. I don't have an iOS simulator runtime on this machine, so I haven't run the iOS scheme; the change is in AppAuthCore only. Added a CHANGELOG entry under UNRELEASED.